Yonglong Liu bb989501ab net: hns: Fix use after free identified by SLUB debug ... When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will identify a use after free bug: [134.189505] Unable to handle kernel paging request at virtual address 006b6b6b6b6b6b6b [134.197553] Mem abort info: [134.200381] ESR = 0x96000004 [134.203487] Exception class = DABT (current EL), IL = 32 bits [134.209497] SET = 0, FnV = 0 [134.212596] EA = 0, S1PTW = 0 [134.215777] Data abort info: [134.218701] ISV = 0, ISS = 0x00000004 [134.222596] CM = 0, WnR = 0 [134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges [134.232851] Internal error: Oops: 96000004 [#1] SMP [134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G OE 4.19.5-1.2.34.aarch64 #1 [134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018 [134.255181] pstate: 20000005 (nzCv daif -PAN -UAO) [134.260044] pc : hns_ae_put_handle+0x38/0x60 [134.264372] lr : hns_ae_put_handle+0x24/0x60 [134.268700] sp : ffff00001be93c50 [134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040 [134.277442] x27: 0000000000000000 x26: 0000000000000000 [134.282830] x25: 0000000056000000 x24: 0000000000000015 [134.288284] x23: ffff0000096fe098 x22: ffff000001050070 [134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098 [134.303287] x19: ffff80afb75ec098 x18: 0000000000000000 [134.312945] x17: 0000000000000000 x16: 0000000000000000 [134.322517] x15: 0000000000000002 x14: 0000000000000000 [134.332030] x13: dead000000000100 x12: ffff7e02bea3c988 [134.341487] x11: ffff80affbee9e68 x10: 0000000000000000 [134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000 [134.360569] x7 : dead000000000100 x6 : ffff000009579748 [134.370059] x5 : 0000000000210d00 x4 : 0000000000000000 [134.379550] x3 : 0000000000000001 x2 : 0000000000000000 [134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000 [134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd) [134.408498] Call trace: [134.414611] hns_ae_put_handle+0x38/0x60 [134.422208] hnae_put_handle+0xd4/0x108 [134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv] [134.438342] platform_drv_remove+0x2c/0x70 [134.445958] device_release_driver_internal+0x174/0x208 [134.454810] driver_detach+0x70/0xd8 [134.461913] bus_remove_driver+0x64/0xe8 [134.469396] driver_unregister+0x34/0x60 [134.476822] platform_driver_unregister+0x20/0x30 [134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv] [134.494634] __arm64_sys_delete_module+0x238/0x290 struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is freed, than use hnae_handle will cause use after free panic. This patch frees vf_cb after hnae_handle used. Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-01-04 13:33:57 -08:00
..
3com	net: documentation: build a directory structure for drivers	2018-12-05 11:30:06 -08:00
8390
adaptec
aeroflex	net: ethernet: Convert phydev advertize and supported from u32 to link mode	2018-11-11 10:10:01 -08:00
agere
alacritech
allwinner
alteon
altera
amazon	net: ena: update driver version from 2.0.1 to 2.0.2	2018-11-19 15:13:00 -08:00
amd	net: ethernet: don't set phylib state CHANGELINK in drivers	2018-12-18 22:07:20 -08:00
apm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-12-20 11:53:36 -08:00
apple
aquantia	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-12-09 21:43:31 -08:00
arc	net: ethernet: Convert phydev advertize and supported from u32 to link mode	2018-11-11 10:10:01 -08:00
atheros	atl1e: checking the status of atl1e_write_phy_reg	2018-12-27 16:23:12 -08:00
aurora
broadcom	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-12-24 16:19:56 -08:00
brocade
cadence	net: macb: remove unnecessary code	2019-01-04 12:59:09 -08:00
calxeda
cavium	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-12-09 21:43:31 -08:00
chelsio	net: chelsio: Add a missing check on cudg_get_buffer	2018-12-27 16:18:41 -08:00
cirrus	net: documentation: build a directory structure for drivers	2018-12-05 11:30:06 -08:00
cisco	net: core: dev: Add extack argument to dev_open()	2018-12-06 13:26:06 -08:00
cortina	net: gemini: Fix copy/paste error	2018-11-23 22:35:38 -08:00
davicom	net: ethernet: davicom: dm9000: simplify getting .driver_data	2018-10-21 21:10:12 -07:00
dec	net: documentation: build a directory structure for drivers	2018-12-05 11:30:06 -08:00
dlink	net: documentation: build a directory structure for drivers	2018-12-05 11:30:06 -08:00
emulex	net: ndo_bridge_setlink: Add extack	2018-12-12 16:34:21 -08:00
ezchip
faraday	net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts	2018-11-21 16:57:39 -08:00
freescale	fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()	2018-12-28 21:54:12 -08:00
fujitsu
hisilicon	net: hns: Fix use after free identified by SLUB debug	2019-01-04 13:33:57 -08:00
hp
huawei	net-next/hinic:add shutdown callback	2019-01-02 10:13:35 -08:00
i825xx
ibm	ibmveth: fix DMA unmap error in ibmveth_xmit_start error path	2018-12-31 15:40:11 -08:00
intel	Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue	2018-12-20 15:34:30 -08:00
marvell	octeontx2-af: Fix a resource leak in an error handling path in 'cgx_probe()'	2019-01-04 12:44:50 -08:00
mediatek	net: ethernet: Convert phydev advertize and supported from u32 to link mode	2018-11-11 10:10:01 -08:00
mellanox	4.21 merge window pull request	2018-12-28 14:57:10 -08:00
micrel
microchip	lan743x: Remove MAC Reset from initialization	2018-12-19 15:48:11 -08:00
moxa
mscc	USB/PHY patches for 4.21-rc1	2018-12-28 20:30:00 -08:00
myricom	drivers: net: remove <net/busy_poll.h> inclusion when not needed	2018-10-25 16:20:02 -07:00
natsemi
neterion	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-12-20 11:53:36 -08:00
netronome	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2018-12-20 17:31:36 -08:00
ni
nuvoton	w90p910_ether: remove incorrect __init annotation	2018-12-14 14:42:51 -08:00
nvidia
nxp	net: lpc_eth: fix trivial comment typo	2018-11-21 16:17:32 -08:00
oki-semi
packetengines
pasemi
qlogic	qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier	2019-01-04 12:57:30 -08:00
qualcomm	net: qca_spi: convert to DEFINE_SHOW_ATTRIBUTE	2018-12-03 17:33:43 -08:00
rdc
realtek	r8169: Add support for new Realtek Ethernet	2019-01-04 12:49:37 -08:00
renesas	ravb: Clean up duplex handling	2018-11-23 11:14:47 -08:00
rocker	rocker, dsa, ethsw: Don't filter VLAN events on bridge itself	2018-11-23 18:02:24 -08:00
samsung
seeq
sfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-12-27 13:04:52 -08:00
sgi
silan
sis	ethernet/sis: Replace synchronize_sched() with synchronize_rcu()	2018-11-27 09:21:36 -08:00
smsc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-12-27 13:04:52 -08:00
socionext	net: socionext: remove mmio reads on Tx	2018-12-15 13:15:19 -08:00
stmicro	net: stmicro: fix a missing check of clk_prepare	2018-12-27 16:20:44 -08:00
sun	niu: fix missing checks of niu_pci_eeprom_read	2018-12-27 16:19:27 -08:00
synopsys
tehuti
ti	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-01-03 12:53:47 -08:00
toshiba	net: ethernet: Convert phydev advertize and supported from u32 to link mode	2018-11-11 10:10:01 -08:00
tundra
via	net: via: via-velocity: fix spelling mistake "alignement" -> "alignment"	2018-11-27 16:22:23 -08:00
wiznet	net: ethernet: wiznet: w5300: simplify getting .driver_data	2018-10-21 21:10:12 -07:00
xilinx
xircom
xscale
dnet.c
dnet.h
ec_bhf.c
ethoc.c
fealnx.c
jme.c
jme.h
Kconfig
korina.c
lantiq_etop.c
lantiq_xrx200.c	net: lantiq: Fix returned value in case of error in 'xrx200_probe()'	2018-11-16 19:46:49 -08:00
Makefile
netx-eth.c